two VPN tunnel one for main service one for backup using track command

cisco.xenpak1 · ‎08-20-2010

Hello together,

want to configure two tunnels over the internet, I just want to get more input, how to solve the problem, that when a tunnel fails, that the traffic will be shifted over to the other tunnel.

Now the problem is, that the loopback is reachable also through the main connection.

I am thinking to use a track command, that allows me something like this

track 10 ip route 10.0.0.100 255.255.255.255 reachabillity (need this but only over a certain interface, in this case the tunnel1)

Otherwise the loopback 10.0.0.100 is also available thrught the main link when the tunnel is working.

using the interface as determination is not working, since the tunnel is (unless the physical link is down) always up.

anyone knows a command to have the track only check the loopback availabillity over a specific interface?

(like an extended ping with a source parameter i.e. ping 10.0.0.100 source interface tunnel1)

thx for the input

regards

Chris

Jeremy Buck · ‎08-20-2010

Hey xenpak,

From what you've posted It sounds like you have a single router with two tunnels of which you want to have one tunnel be primary and the other be secondary. You want to forward traffic over the primary link only until it fails and then you would switch over to the secondary, correct?

Have you considered configuring another loopback on the distant end routers which is only reachable through the tunnel and tracking those addresses?

If that option is not feasible I would look into configuring EOT with boolean logic (Enhanced Object Tracking).That should provide the ultimate flexibility in IP reachability and interface tracking, you can configure boolean logic!!

http://www.cisco.com/en/US/docs/ios/12_2t/12_2t15/feature/guide/fthsrptk.html#wp1045974

Do you control the tunnel endpoints? If so then you can always run your favorite routing protocol over them.

Thanks,

-Jeremy

cisco.xenpak1 · ‎08-21-2010

Hello Jeremy,

"From what you've posted It sounds like you have a single router with two tunnels of which you want to have one tunnel be primary and the other be secondary. You want to forward traffic over the primary link only until it fails and then you would switch over to the secondary, correct?"

That is correct.

Have you considered configuring another loopback on the distant end routers which is only reachable through the tunnel and tracking those addresses?

Yes, this is one solution, but it requires some configuration. One on the destination router to put in another loopback. Than I need to configure also

that way, that this loopback is only reachbable through this tunnel, ect, ect.

That is a solution that I tested, and it is working 100% but means a lot to configure on all the routers arround it,

Therefore I am looking for a easier solution with the tracking going over a specific interface.

You mentionend something about control of the endpoints. Yes, I do have controls over the tunnel endpoints. There are running BGP.

Certainly I will check out the boolean logic and the link you've sent me.

Thx for that one already.

Regards

Chris

Lei Tian · ‎08-20-2010

Hi Chris,

Why won't you just track the remote end physical interface's IP?

HTH,

Lei Tian

cisco.xenpak1 · ‎08-21-2010

Hi Lei Tian,

than you for your answer.

The reason for this tracking is to ensure, that the tunnel is working.

Tracking a physical interface does not work at all.

Chances that something along the way is not working is much more propable.

The tunnel endpoints facing a larger network over that I have no control.

So even when the link is up with my local connection, it does not mean, that the tunnel is working.

Regards

Chris

Lei Tian · ‎08-21-2010

Hi Chris,

Does your IOS support IP SLA with track? Within IP SLA, you can configure the type as ICMPecho, and set the source interface.

HTH,

Lei Tian

samirshaikh52 · ‎08-21-2010

You can also the administrative distance if you two routing.Static and dynamic (BGP Protocol)

Make it Static 120 and BGP 90

This was tested by me and working